Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Interpreting path info in "strict transport security not enforced" issues

A | Last updated: Jun 18, 2019 12:45PM UTC

Hi, In "target"->"site map"->"Issues" tab, I sometimes see reported issues labelled "Strict transport security not enforced" with a path set to "/", but when the request is shown, the path is actually something else. e.g. in the "issues" panel: ! Strict Transport Security not enforced [1] --! / --! /api/ --! /api/getObjects when clicking on the first issue (path = "/"), the request tab then shows: GET /api/somethingElseNotIntheOriginalList HTTP/1.1 ... How should I interpret this? Is this a bug or...? Regards, a.f.

PortSwigger Agent | Last updated: Jun 18, 2019 01:04PM UTC

Strict Transport Security issues generally affect a whole server, so Burp reports them once at the root, rather that reporting every single instance. The request you see is the very first request that Burp observed without the header.

Burp User | Last updated: Jun 21, 2019 12:20PM UTC